[GKE] April 13, 2022

[github-actions]

Security

A security vulnerability, CVE-2022-23648, has been discovered in containerd's handling of path
traversal in the OCI image volume specification. Containers launched through containerd's CRI
implementation with a specially-crafted image configuration could gain full read access to
arbitrary files and directories on the host. This vulnerability may bypass any policy-based
enforcement on container setup (including a Kubernetes Pod Security Policy). This
vulnerability affects all GKE node operating systems
(Container-Optimized OS and Ubuntu) which use containerd by default. All
GKE, Autopilot, and GKE Sandbox nodes are affected.

For more information, see the GCP-2022-013 security bulletin.

Feature

Egress NAT policy to configure IP masquerade is now generally available on GKE Autopilot clusters with Dataplane v2 in versions 1.22.7-gke.1500+ or 1.23.4-gke.1600+. For configuration examples of Egress NAT policy, see Egress NAT Policy documentation.